CVE-2026-34487: Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of...

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Ghostwire Analysis — What This Means Practically

Exploitation Probability (EPSS): Low — 0.02% (5th percentile)

Low exploitation probability based on current threat landscape data. Standard patching timeline is appropriate.

Medium CVSS score indicates moderate risk — exploitation requires specific conditions or results in limited impact.
Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

CVE-2026-34487: Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of...

Description

Ghostwire Analysis — What This Means Practically

Security Coverage (2 articles)

References